rkhunter output help

chaz_bro1972 · 07-09-2008, 07:42 PM

I have used rkhunter and chkrootkit to check my system for rootkits. Chkrootkit finds nothing, while rkhunter has listed some 'warnings' for me. I have no idea what I am supposed to do with these warnings. Are they false positives? Are they evidence of rootkits? I don't have a clue.

If you want to check out these warnings, go here

Searching Google just gives me a headache. I keep getting different users who use different distros other than Slackware.

People on IRC are no help at all.

Any help at all would be a nice change of pace. If all you can do is say "Search Google", then do not even bother responding.

Thank you.

bgeddy · 07-09-2008, 08:00 PM

The warnings are just warning you about settings that are standard to a stock Slackware setup - they are nothing to worry about.

The scripts mentioned are supposed to be scripts, the services activated are on by default in /etc/inetd.conf and the stock setup file /etc/ssh/sshd_config comments out the PermitRootLogin setting.

So, again, nothing to worry about.

I'd recommend reading http://www.slackbook.org/ to get acquainted with your system.

gilead · 07-09-2008, 09:00 PM

If you have sshd and inetd running I'd suggest a couple of changes.

On the Slackware 12.0 box I'm looking at now, PermitRootLogin defaults to yes, so you should set it to no. The Protocol setting defaults to 2,1 and should be set to 2. I've also commented out all except the services I actually use in /etc/inetd.conf (imaps and cvspserver on this box).

simcox1 · 07-11-2008, 11:08 AM

You can also ask questions regarding rkhunter on their mailing list. You'll probably see someone has already asked this question before anyway. This is a link to the project page on sourceforge.

http://rkhunter.sourceforge.net/

The link to the users mailing list is on the right.

chaz_bro1972 · 07-11-2008, 02:00 PM

Thank you kindly for all this assistance. It's nice to know there is still this helpful community for Linux users.

bgeddy & gilead: fixed those things, and it looks better now - THANKS!

simcox1: Thanks you for the link. Nice to know about these places to go. I wasn't aware of the mailing list, until now.